Italian Garante Fines IQVIA €7M Over Pseudonymised Health Data
Italy's data protection authority has fined IQVIA €7 million over pseudonymised health data, a distinction that governs how life sciences clients license, share and reuse real-world clinical information.
Arnold & Porter's BioSlice blog reports that Italy's Garante per Pubblica Autorità per la Garante per la protezione dei dati personali has imposed a €7 million fine on IQVIA in an enforcement action about pseudonymised health data, with the firm's commentary framed around the line between "pseudonymised" and "anonymous." Only the headline-level summary was available for this cluster, so the specific conduct, processing activities, legal provisions and procedural posture are not confirmed here and should be verified against the Garante's order before being relied on.
Sophisticated counsel should still take the significance signal seriously. Under the GDPR and Italian implementation, pseudonymised data remains personal data, and re-identification risk analysis is what determines whether downstream research, secondary-use or cross-border transfer flows are lawful. A financial penalty against a major clinical-research and data-services provider signals that supervisory authorities in Europe are testing the anonymisation claims underpinning real-world evidence and market-access datasets, a value chain many pharma, biotech and healthcare clients depend on.
Practical next steps: review the Garante's published reasoning once released, audit vendor and collaborator claims of anonymisation in trial-data and observational datasets, and refresh DPIAs and data-sharing agreements. Watch for follow-on challenges to published RWE studies and for possible coordination with other European authorities.